Indicator¶
-
class
trustar.models.indicator.
Indicator
(value, type=None, priority_level=None, correlation_count=None, whitelisted=None, weight=None, reason=None, first_seen=None, last_seen=None, sightings=None, source=None, notes=None, tags=None, enclave_ids=None)¶ Models an Indicator.
Variables: - value – The indicator value; i.e. “www.evil.com”
- type – The type of indicator; i.e. “URL”
- priority_level – The priority level of the indicator
- correlation_count – The number of other indicators that are correlated with this indicator.
- whitelisted – Whether the indicator is whitelisted or not.
- weight – see Indicator for details.
- reason – see Indicator for details.
- first_seen – the first time this indicator was sighted
- last_seen – the last time this indicator was sighted
- sightings – the number of times this indicator has been sighted
- source – the source that the indicator was observed from
- notes – a string containing notes about the indicator
- tags – a list containing Tag objects associated with the indicator
- enclave_ids – a list of enclaves that the indicator is found in
- TYPES – A list of all valid indicator types.
-
classmethod
from_dict
(indicator)¶ Create an indicator object from a dictionary.
Parameters: indicator – The dictionary. Returns: The indicator object.
-
to_dict
(remove_nones=False)¶ Creates a dictionary representation of the indicator.
Parameters: remove_nones – Whether None
values should be filtered out of the dictionary. Defaults toFalse
.Returns: A dictionary representation of the indicator.